Emerson Bettis GVO-C Series Instruction Manual

SIL Safety Manual
SM-025-GVO Rev. 0
November 2017
Bettis GVO-C Series Pneumatic Actuators
GVO-CLP-SR/FS SIL Safety Manual

SIL Safety Manual
SM-025-GVO Rev. 0
Table of Contents
November 2017
3
Table of Contents
Table of Contents
Section 1: Introduction
Section 2: Acronyms
Section 3: Functional Specification
Section 4: Product Description
4.1 GVO-CLP-SR/FS pneumatic linear spring return actuator general description 7
4.2 GVO-CLP-SR/FS working principle ................................................................. 8
Section 5: Service Condition Limitations (limitation of use)
Section 6: Expected Time
Section 7: Failure Modes and Estimated Failure Rates
Section 8: Periodic Text and Maintenance Requirements
8.1 General ....................................................................................................... 13
8.2 Full Stroke Test (Proof Test) ......................................................................... 13
8.3 Diagnostic Coverage / Proof Test Coverage ................................................. 15
8.4 Partial Stroke Test ....................................................................................... 16
8.5 Partial Stroke Diagnostic Coverage / Test Coverage ..................................... 19
8.6 Periodic Maintenance.................................................................................. 19
Section 9: Classification
Section 10: MRT
Section 11: Architectural Constraints
Section 12: Systematic Capability
Section 13: Manufacturer Notes

November 2017
SIL Safety Manual
SM-025-GVO Rev. 0
4
Section 1: Introduction
Introduction
Section 1: Introduction
This safety manual provides essential information necessary to design, install, verify and
maintain a Safety Instrumented Function (SIF) utilizing Emerson Actuator Series
GVO-CLP-SR/FS. This manual provides necessary requirements for meeting the IEC
61508:2010 (Sections 1 to 7) or IEC 61511 functional safety standards.

SIL Safety Manual
SM-025-GVO Rev. 0 November 2017
5
Section 2: Acronyms
Acronyms
Section 2: Acronyms
FMEDA: Failure Modes, Effects and Diagnostic Analysis
HFT: Hardware Fault Tolerance
(ref: 7.4.4 of IEC 61508-2:2010)
PFDAVG:Average Probability of dangerous Failure on Demand
(ref: 3.6.18 of IEC 61508-4:2010)
SFF: Safe Failure Fraction, property of a safety related element that is dened by
the ratio of the average failure rates of safe plus dangerous detected failures
and safe plus dangerous failures (ref: 3.6.15 of IEC 61508-4:2010)
SIF: Safety Instrumented Function, safety function with a specied safety
integrity level which is necessary to achieve functional safety and which
can be either a safety instrumented protection function or a safety
instrumented control function.
SIL: Safety Integrity Level, discrete level (one out of a possible four) for specifying
the safety integrity requirements of the safety functions to be
allocated to the E/E/PE safety related systems where Safety Integrity Level
4 has the highest level of safety integrity and Safety Integrity Level 1 has the
lowest. (ref: 3.5.8 of IEC 61508-4:2010)
SIS: Safety Instrumented System – Implementation of one or more Safety
Instrumented Functions. A SIS is composed of any combination of sensor(s),
logic solver(s), and nal element(s).

November 2017
SIL Safety Manual
SM-025-GVO Rev. 0
6
Section 3: Functional Specification
Functional Specification
Section 3: Functional Specication
The safety function performed by Emerson actuator series GVO-CLP-SR/FS is dened as
follows:
The actuator performs the safety function on demand if it delivers a full stroke driven by
the spring, moving the valve to the safe position (either closed or open depending upon
the valve to be actuated) when the system is de-energized.
The choice of the safety function to be implemented is responsibility of the system
integrator.
GVO-CLP-SR/FS actuator is intended to be part of the nal element subsystem as dened
per IEC 61508:2010. The achieved SIL level of the designed function must comply with the
project specication and must be submitted to the system integrator.
The nal control element subsystem needs to be sized properly to assure that its operating
time is equal or less than the time required to reach a safe state.
GVO-CLP-SR/FS actuator will move the valve to its safe state in equal or less than the
required SIF’s response time under the specied conditions.

SIL Safety Manual
SM-025-GVO Rev. 0 November 2017
7
Section 4: Product Description
Product Description
Section 4: Product Description
4.1 GVO-CLP-SR/FS pneumatic linear spring return
actuator general description
Emerson GVO-CLP-SR/FS low pressure pneumatic spring return linear actuator series is
engineered and is manufactured to provide fail safe operation for any linear application such
as wedge gate and through conduit gate valves, in On-Off and Modulating Heavy duty service;
simplicity, reliability and economy are at the top of the list of design parameters.
Supply pressure is maximum 12 bar-gauge, accepting air, nitrogen or sweet gas.
Supported standard ambient temperature ranges from –30°C to +100°C, special versions of
actuators are available to be used for applications outside this temperature range.
The actuator is composed of a pneumatic cylinder, a spring cartridge and a mounting pedestal
complete with a joint for the coupling to the valve stem of actuator output stem.
The valve is actuated in opening and in closing position by the actuator pneumatic cylinder in
one direction and by the spring unit in the other direction. The output thrust of spring unit can
be downward or upward according to valve operation requirements (spring to open, spring
to close, direct acting valve, reverse acting valve).
The spring return pack incorporates up to four springs, fully encapsulated in a factory welded
cartridge: this assures safety conditions to personnel and simplifies the assembly. The
linear stroke of the valve is adjustable by means of the external mechanical stop and by the
adjustment of the coupling of valve stem to actuator joint.
The actuator pedestal has a ange with threaded holes to x the actuator to the valve.
A general sectional view of the actuator is shown in Figure 1.
Emerson can supply different types of control systems, following customer’s requirements.
Figure 1 GVO-CLP-SR/FS Actuator Overview

November 2017
SIL Safety Manual
SM-025-GVO Rev. 0
8
Section 4: Product Description
Product Description
4.2 GVO-CLP-SR/FS working principle
Emerson GVO-CLP-SR/FS actuator working principle is simplied in the following Figure 2.
In the normal operating situation the operating uid (instrument air, nitrogen or sweet gas)
is supplied to the actuator’s open (close) chamber of the pneumatic cylinder: the cylinder
piston stroke causes the actuator operation and the consequent valve movement to the open
(close) operational position, and at the same time compresses the spring. Upon a demand,
the instrument air is discharged from the open (close) chamber of the cylinder: the actuator
performs the closing (opening) operation driven by the spring, and the valve moves from the
open (close) position to the close (open) position (safety-related position).
Figure 2 GVO-CLP-SR/FS actuator simplified working principle
PNEUMATIC CONNECTION

SIL Safety Manual
SM-025-GVO Rev. 0 November 2017
9
Section 5: Service Condition Limitations
Service Condition Limitations
Section 5: Service Condition Limitations
(limitation of use)
The designer of an SIF must check that the product is rated for use within the expected
application limits. The operating conditions limits strongly depend on the actuator type and
on its construction materials.
Operating pressure values are dened for each actuator.
Temperature limits are the following:
• Standard ambient temperature range: -30°C to +100°C
• Extended ambient temperature range: -60°C to +200°C (special versions)
Supply medium: instrument air, nitrogen or sweet gas (sour gas special version is available).
If GVO-CLP-SR/FS actuator is intended to be used outside the application limits or with
incompatible materials, the reliability data provided in the present document are invalid.
• The actual environmental conditions are included on the actuator nameplate
• The chose values are valid for the lifetime specied in Section 6.
• Manual override
Normally, the GVO-CLP-SR/FS actuators can be tted with one of the following types of
manual overrides:
• MHW Manual Hand-wheel mounted on the end ange of the pneumatic cylinder
• MHP Manual Hydraulic override including an additional hydraulic cylinder with
manual pump and distributor
With reference GVO-CLP-SR/FS actuator, the mechanical manual override can be done with
three conguration depending of the actuator size:
The use of a manual override is not recommended in a SIL classied application, as it results
in a bypass of the safety function.
In case the manual override is used, the following requirements must be fulllled, or the
Functional Safety Certication will become invalid:
1. The users authorized to operate on the actuator shall be skilled personnel;
2. The maximum duration of bypass shall be dened (responsibility of the nal user).
3. If necessary, compensatory measures to allow the safe operation of the process
shall be dened (responsibility of the nal user).
4. Before selecting remote operating mode control of actuator, the manual override
must be disengaged according to IOM Manual. The position selected
(remote/automatic control or local / manual control) can be achieved with a
specic technical solution that does not allow to reach an intermediate position
lever’s and avoids unintentional activation.
5. The engagement of the manual override shall be signalled, at least locally,
according to IOM Manual. As optional request from nal user, to determine if the
manual override is engaged, an electrical signal using contact switching can be
provided to communicate the status to the control room.

November 2017
SIL Safety Manual
SM-025-GVO Rev. 0
10
Section 5: Service Condition Limitations
Service Condition Limitations
Table 1.
MHW Manual Hand-wheel
MHP Manual Hydraulic
To ensure that the hand pump has been correctly disengaged after a manual override
operation, the following test shall be completed:
- restore the manual lever to remote position;
- verify the functionality performing a test from remote control (es. partial stroke test).